Vulnerability in cpufreq governor of Kernel: Use kobject release() method to free dbs_data
Summary
GSD-2022-1002805: cpufreq: governor: Use kobject release() method to free dbs_data. Affects Kernel versions >= c4435630361d9bebf7154a0c842dc1fb7ae39c99, < 1e32083f327184b6226ce320ef30085ce785ea4e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that manages system resources and provides an interface for software to interact with hardware. The cpufreq governor is responsible for dynamically adjusting the CPU frequency to optimize performance and power consumption. The dbs_data structure is used by the governor to store information related to frequency scaling decisions. However, a vulnerability exists in the implementation of the governor, where the dbs_data structure is not properly freed, potentially leading to resource leaks and memory corruption.
Vulnerability Detail
The vulnerability arises from the lack of using the kobject release() method to free the dbs_data structure in the cpufreq governor. This oversight can result in memory leaks and potential exploitation by attackers. If an attacker can trigger the vulnerable code path, they may be able to manipulate the memory allocation and corrupt the system's memory, leading to a denial of service or arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to manually modify the code in the cpufreq governor to include the necessary kobject release() method. Here is an example of the code modification:
// Add the following line before returning from the governor function
kobject_put(&dbs_data->kobj);
Please note that applying manual code modifications should be done with caution and thoroughly tested in a controlled environment.
Conclusion
The vulnerability in the cpufreq governor of the Kernel, which involves the improper freeing of the dbs_data structure, can lead to memory corruption and potential security risks. It is crucial to update the Kernel to version v5.18.3 or later to address this vulnerability. If immediate updating is not feasible, manual code modifications can be applied with caution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The cpufreq governor is a component of the Linux Kernel that dynamically adjusts the CPU frequency to optimize performance and power consumption. It determines the appropriate frequency scaling decisions based on various factors such as system load and power management policies.
The impact of this vulnerability can vary depending on the specific system and the attacker's capabilities. If successfully exploited, it could lead to memory corruption, resource leaks, denial of service, or arbitrary code execution.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a patch for this vulnerability is available in the Linux Kernel version v5.18.3. It is recommended to update to this version or later to mitigate the risk.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the recommended fixes and stay updated to minimize the risk of potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
